Implementation Guideline ISO/IEC 27001:2013

91. IntroductionThe systematic management of information security in accordance with ISO/IEC 27001:2013 is intended to ensureeffective protection for information and IT systems in termsof confidentiality, integrity, and availability.1 This protectionis not an end unto itself; rather, its aim is to support businessprocesses, the achievement of business objectives, and thepreservation of company assets by providing and processinginformation without disruptions. An ISMS generally employsthe following three perspectives:ZZ G – Governance perspective-- IT and information security objectives derived fromoverarching company objectives (e.g., supported by/derived from COSO or COBIT)ZZ R – Risk perspective-- Protection requirements and risk exposure ofcompany assets and IT systems-- Company’s attitude towards risk-- Opportunities vs. risksZZ C – Compliance perspective-- External regulations laid out by laws, regulators, andstandards-- Internal regulations and guidelines-- Contractual obligationsThese perspectives determine which protective measures areappropriate and effective forZZ the organization’s opportunities and business processes,ZZ the level of protection required in regards to the criticalityof the company assets in questionZZ compliance with applicable laws and regulations.Technical and organizational measuresTechnical and organizational measures (TOMs) to achieveand maintain smooth and consistent information processingmust be effective in order to achieve the required level ofprotection; they must also be efficient.1ISO/IEC 27001:2013, and the TOMs comprehensively andsystematically laid out therein (various versions and qualitylevels of which are part of operating any ISMS), support theprocess of achieving the objectives initially laid out in termsof all three perspectives:ZZ the governance perspective refers to the control aspects ofthe ISMS, such as the close involvement of top management (see: Chapter 3.2 Leadership and Commitment),consistent business and information security objectives(see: Chapter 3.3 IS Objectives), an effective and targetgroup-oriented communication strategy (see: Chapter 3.9Communication), and appropriate policies and organizational structures (see: Chapter 3.5 Roles, Responsibilitiesand Competencies).ZZ the risk perspective, which serves as a basis for transparent decision-making and prioritization of technical andorganizational measures, is one of the key aspects of anISMS in accordance with ISO/IEC 27001:2013. It is represented by IS risk management (see: Chapter 3.6 RiskManagement) and includes standards and methods foridentifying, analyzing, and assessing risks in the contextof information security – meaning risks that present a potential threat to the confidentiality, integrity, and/or availability of IT systems and information and, ultimately, thebusiness processes that depend on them.ZZ the compliance perspective is firmly anchored throughout the entire standard. It comprises the definitions ofthe required (security) provisions, supported by the recommended controls in Annex A. Also addressed are theconcrete implementation of these provisions, which mustbe ensured through regular monitoring by managementand the Information Security Officer (see: Chapter 3.7Performance Monitoring & KPIs) and by internal audits(see: Chapter 3.12 Internal Audit and 3.14 ContinuousImprovement). Appropriate documentation (see: Chapter3.8 Documentation) and a reasonable level of awarenessof security issues among employees and managers (see:Chapter 3.10 Competence and Awareness) are also vitalfrom the compliance perspective.Authenticity and non-repudiation can be viewed as secondary integrityobjectives.Implementation Guideline ISO/IEC 27001:2013

10 IntroductionCompany managementGovernanceManagement reportsImplementation of andcompliance withcompany objectivesComplianceRisk managementIdentification, assessmentand treatment of risksObjectivesRulesImplementation of andcompliance with regulatory,contractual andlegal requirementsRisksObjectivesRisk managementRulesInformation securityRisksInformation security requirements (requirements, control objectives, policies)Controlling information securityBO/ITInformation security measures (controls, measures)Business organization and IT managementFigure 1: Incorporating the ISMS into corporate control processes22Legal andcontractual provisionsCompany risksSource: Carmao GmbHImplementation Guideline ISO/IEC 27001:2013Compliance reportsinformation security management system (ISMS)Company objectives

112. Guideline Structure2.1 Subject Areas6. Risk ManagementThis implementation guideline is based on the fundamentalsubject areas of the ISO/IEC 27001:2013 standard; however, it does not identically copy the clause structure of thestandard. Rather, the relevant subject areas of an ISMS inaccordance with ISO/IEC 27001:2013 are described as ‘corecomponents’ or ‘building blocks’ that have proven relevantand necessary in the field. Against this backdrop, contentfrom the affected clauses of the standard has been restructured and summarized in individual key subjects. According tothe authors, the standard can essentially be broken down intothe 14 components explained in the following. These components, taken together, comprise an organization’s ISMS:2. Leadership and Commitment3. IS Objectives9. Communication10. Competence and Awareness11. Supplier Relationships12. Internal Audit13. Incident Management14. Continuous ImprovementAdditionally, this guideline is primarily intended to providepractical assistance; therefore the explanation of the components extends beyond the content that would normally berequired by ISO/IEC 27001:2013 (or ISO/IEC 27002:2013).4. IS Policy5. Roles, Responsibilities and CompetenciesIS Objectives8. DocumentationThe following chapters lay out the key success factors forall components in regards to standard-compliant, practicallyoriented implementation.1. Context of the OrganizationLeadershipandCommitment7. Performance Monitoring & KPIsIS agementPerformanceMonitoring &KPIsAvailabilityContextof ding toISO/IEC27001CompetenceandAwarenessIncident ManagementSupplierRelationshipsInternal AuditContinualImprovementFigure 2: Components of an ISMS in accordance with ISO/IEC 27001:2013Implementation Guideline ISO/IEC 27001:2013

12 Conversely, this also means that not all information providedin this document will be equally useful for all informationsecurity management systems or organizations.Setting up an ISMS, regardless of whether it is done voluntarily or for a required certification, is an ambitious projectthat, like any other project, requires ‘SMART’1 objectives,sufficient professional resources, the right project manager,and a qualified team. Additionally, consistent, visible supportfrom top management is vital for the successful completionof the project and the subsequent transition to ISMS operation.In addition to providing assistance, the implementation guideline also includes references to other standards, frameworks, and other helpful sources (which are correspondinglylabeled).2.2 Chapter StructureThe individual chapters are all structured the same way andare broken down into the following three sections:ZZ Success factors for practical implementation This section lays out the success factors that the authorsconsider most important for setting up and operating anISMS in accordance with ISO/IEC 27001:2013.ZZ Documentation requirements This section lays out the documentation requirementsstipulated by the standard and recommended based onpractical experience.ZZ References This section provides the clause numbers from ISO/IEC27001:2013 that are relevant to the subject area, as wellas any other sources that might be necessary or helpful.1SMART: specific, measurable, attainable, realistic, timelyImplementation Guideline ISO/IEC 27001:20132.3 Conventions2.3 ConventionsWhen the term ‘standard’ is used throughout this documentwithout further explanation, it always refers to the ISO/IEC27001:2013 standard.The term ‘chapter’ refers to the various parts of this guideline;the term ‘clause’ refers to the various parts of the standard.The term ‘appendix’ refers to the appendices to this guideline; the terms ‘annex’ and ‘Annex A’ refer to Annex A of thestandard.The terms ‘organization’ and ‘company’ each refer to the institution/department where the ISMS will be implemented.The terms are used interchangeably throughout the guideline.

133. C omponents of an ISMS in accordance withISO/IEC 27001:20133.1 Context of the OrganizationSituation AnalysisDuring the implementation of an ISMS, one of the first tasksis determining the accurate scope of the management systemand the analysis of the requirements and the situation of theorganization and its stakeholders.The purpose of the situation analysis is to place the ISMSinto the overall environment based on its scope. In addition to the organizational and technical relations relevant tothe ISMS, it should also include conditions that are typicalfor the respective industry or location. This must include theinternal context, such as other management systems (ISO9001:2015, ISO 22301:2012, etc.), as well as how it relatesto other important departments such as risk management,human resources, data protection, audit and legal - if this isnot already part of the existing scope. It must also includethe external context, such as important suppliers and serviceproviders, strategic partners, and any other relevant organizations.Determining the scopeIn accordance with the standard, the scope must be documented and, in addition to the processes and divisions covered by the ISMS, it should also include the results of theanalysis of the requirements and situation.ZZ the scope document is primarily intended for the stakeholders of the management system, and if they requestit, it should be provided to them. It is the only way thatstakeholders (such as customers) can verify whether theISMS covers the processes, infrastructure, subjects or requirements relevant to them.ZZ in practice, when organizations receive inquiries on thissubject, they often refer to ISO/IEC-27001:2013 certificates that they hold, which, upon closer inspection, turn outto be irrelevant to or insufficient for the inquiry, becausethe process in question is not covered or only partiallycovered by the ISMS. To avoid any unpleasant and unintended surprises, the scope document and/or a precisedescription of the scope should be requested in additionto the certificate.ZZ another important document regarding the scope of anISMS is the statement of applicability (SoA) required bythe standard. The SoA includes explanations of the decisions to implement the controls in Annex A – i.e., whetherthe control in question is used within the ISMS or not,including an appropriate justification.ZZ a rough outline of the scope is usually provided in theinformation security policy. Unlike the scope document,the security policy and the SoA are generally categorizedas internal documents and should not be passed on toexternal parties. However, as previously mentioned, closeattention must be paid to the precise definition of thescope and the content of the SoA in the context of serviceprovider relationships and, if applicable, service provideraudits.Requirement AnalysisThe persons in charge of the ISMS need to have a clear overview of the existing stakeholders, and their requirements forthe organization and the management system.The requirements of interested parties may include legal andofficial provisions (for example the German Federal DataProtection Act BDSG, the German Act against Unfair Competition UWG, the German Telemedia Act TMG, regulatoryauthorities, etc.) as well as contractual obligations. The organization itself (or an organization on a higher hierarchicallevel) might also have decision-making and/or policy-makingauthority, which must be taken into account.Success factors for practical implementationDetermining the scope is the first and most decisive step inthe process of setting up and operating an ISMS, thereforethis phase should be carried out with extra diligence.The context must be understood before any further actions(establishing and conducting risk analysis, organizationalstructure, defining and prioritizing tasks, project planning,etc.) are taken; this is also an important prerequisite for estimating the feasibility and the amount of work involved (resources, budget, time) in setting up and eventually operatingthe ISMS.ZZ lists are provided in ISO 31000:2009, Clause 5.3.2 ‘Establishing the external context’ and Clause 5.3.3 ‘Establishing the internal context;’ these lists help to ensure thatthe information provided is complete.Implementation Guideline ISO/IEC 27001:2013

14 3.2 Leadership and CommitmentZZ the required level of detail for defining the scope is generally determined by internal and external information security requirements of the organization. In practice, it hasproven helpful to describe the areas impacted by the ISMSin detail in the scope document, as this description is animportant control instrument that is relevant for strategicdecision-making and (future) coordination.3.2 Leadership and CommitmentZZ the identification of stakeholders (and their requirements)as described in Clause 4.2 of the standard must be conducted carefully and comprehensively, as this is the onlyway to define clear objectives and content for the ISMSand to achieve the best possible benefit. Examples ofstakeholders include: Owners, shareholders, supervisoryboard, regulatory authorities/lawmakers, customers, clients, suppliers, service providers, employees, etc.To achieve this, the business objectives and requirementsmust be known, and the appropriate organization (such asthe implementation/adaptation of risk management processes in the organization) must be put in place.ZZ relevant external requirements can result from businessplans, contracts, and regulations on the affected businessprocesses set out by supervisory authorities and lawmakers, etc. In practice, support to determine these requirements is generally provided by someone in the (IT-) compliance role.Documentation requirementsA successful ISMS is implemented “top down” and establishes a connection between business objectives and information security by taking stakeholders’ requirements into account, and by using effective measures to reduce risk to theoperational business processes to an acceptable level.Approval and support from top management is indispensableto ensure a mandatory character and acceptance of the introduced management system processes.The standard correctly and explicitly requires top management to take full and verifiable responsibility for informationsecurity within the organization. In addition, the importanceof an effective ISMS and compliance with its requirementsmust be communicated to the affected employees. This is generally achieved by means of the information security policy(see Chapter 3.4 IS Policy).The following minimum documentation requirements applyaccording to ISO/IEC 27001:2013:ZZ under the headline ‘IT governance’ and in relation tomanagement’s responsibility for strategy, particularly inZZ scope of the ISMS (Clause 4.3)areas subject to regulation, the supervisory authoritiesand boards are requesting verifiable proof of responsibiliZZ statement of applicability (Clause 6.1.3 d)ty in an increasing manner.1, 2ZZ overview of all relevant legal, regulatory, and contractualrequirements that have an impact on the information se- Success factors for practical implementationcurity strategy and the ISMS (A.18.1)Definition, ‘top management’Additionally, the following documents have proven useful in ‘Top management’ refers to the level of management who ispractice:responsible for managing the organization that the ISMS isintended to protect and who makes decisions regarding theZZ overview of all stakeholders relevant to the specific scope use of resources.of the ISMSReferencesISO/IEC 27001:2013 – Clauses 4.3 and 6.1.3ISO/IEC TR 27023:2015ISO 22301:2012ISO 31000:2009ISO 9001:201512Implementation Guideline ISO/IEC 27001:2013Joint Committee Report on Risks and Vulnerabilities in the EU FinancialSystem, Chapter 7 (http://www.esma.europa.eu/system/files/jc-201418 report on risks and vulnerabilities in the eu financial systemmarch 2014.pdf).Erläuterung zu den MaRisk in der Fassung vom 14.12.2012, AT 4.2, AT undschreiben/dl rs1210 erlaeuterungen ba.pdf? blob publicationFile&v 3) (Germanonly).

3.3 IS Objectives ZZ according to the standard, ‘top management’3 at largecorporations does not necessarily refer to the highest levelof management in the entire organization (e.g., Board ofDirectors). It can also refer to the local managers or department managers responsible for the ISMS. The decisive factor here is the specific scope of the ISMS in question.ZZ during an external certification audit, a certification bodymay still require the involvement of the top managementof the entire organization (for reasons of liability for risk).For this reason, it is advisable to address this issue withthe certification body before launching the process of applying for the certification.Tasks/responsibilities, ‘top management’ISO/IEC 27001:2013 requires members of top managementto serve as role models on topics related to information security. In practical terms, this includes visible involvement inthe process, obvious dedication to information security, aswell as:ZZ compliance with information security requirements,ZZ making sufficient resources available in a transparentmanner,ZZ requiring other levels of management to serve as role models,ZZ consistently dealing with and reacting to cases of nonconformity,ZZ self-commitment to continuous improvement.The primary duties of top management in the context ofISMS are:15Documentation requirementsThe following minimum documentation requirements applyaccording to ISO/IEC 27001:2013:ZZ clause 9.3 ‘Management Review’ requires documentation of the fact that top management monitors the ISMS,including the decisions regarding changes and improvements to the ISMS. They can be included in the risk treatment plan in the form of measures.ZZ results of a management review, such as decisions on options for continuous improvement, must be retained asdocumented information.Additionally, the following documents have proven useful inpractice:ZZ a document that records the derivation and assessmentof risks resulting from existing discrepancies between thestrategic IS objectives and the degree of objectives achieved, ideally in the form of a risk treatment plan.ZZ documents (presentations, logs, minutes, reports, etc.)which provide evidence for an effective reporting to thetop management.Note: There are several documentation options in the context of management responsibility. The examples above aresuggestions for possible types of recording that contributeto making reporting and decision-making processes moretransparent. Each organization must determine the type andfrequency of documentation that works best.ReferencesISO/IEC 27001:2013 – Clauses 5.1, 9.1 and 9.3ZZ taking full responsibility for information securityZZ defining the information security strategy and the concrete IS objectives (see Chapter 3.3 IS Objectives)ZZ defining the decision-making criteria and principles forassessing and treating risks and implementing appropriate processes (see Chapter 3.6 Risk Management)ZZ integration of information security requirements intobusiness processes and project management models (seeChapter 3.6 Risk Management)ZZ conducting regular ISMS (top) management reviews (seeChapter 3.14 Continuous Improvement)ZZ providing necessary financial and human resources to setup the ISMS and to implement the information securitystrategy33.3 IS ObjectivesThe ISMS as a whole contr

Implementation Guideline ISO/IEC 27001:2013 1. Introduction The systematic management of information security in ac-cordance with ISO/IEC 27001:2013 is intended to ensure effective protection for information and IT systems in terms of confidentiality, integrity, and availability.1 This protectionFile Size: 2MB